Bug #2492

openssl beast workaround disabled in 1.4.32

Added by betelgeuse over 2 years ago. Updated over 2 years ago.

Status:FixedStart date:2013-07-11
Priority:NormalDue date:
Assignee:-% Done:


Target version:1.4.33
Missing in 1.5.x:No



lighttpd is setting the same SSL_OP_ALL so beast mitigation is not on.

long ssloptions =

I checked trunk and there the option is not set on so hopefully just a matter of backporting.

Associated revisions

Revision 2891
Added by stbuehler over 2 years ago

[ssl] add option ssl.empty-fragments, defaulting to disabled (fixes #2492)

if ssl.empty-fragments is set to enabled, but the openssl version used
to compile lighttpd doesn't support empty fragments, a warning is
displayed (it might still work).

From: Stefan B├╝hler <>


#1 Updated by stbuehler over 2 years ago

  • Priority changed from Urgent to Normal
  • Target version set to 1.4.33

svn trunk is "dead". For beast mitigation we recommend using TLS1.1+ or preferring RC4 (after TLS1.1+ ciphers) as cipher, see the 1.4.30 release announcement

As some implementations can't handle the empty fragment workaround I'm not sure I even want to change that. Afaics apache only added an option to reenable the workaround, not making it the default.

Perhaps we'll add an option too, but right now I don't think it will be active by default.

#2 Updated by stbuehler over 2 years ago

  • Status changed from New to Fixed
  • % Done changed from 0 to 100

Applied in changeset r2891.

Also available in: Atom